I have configured postfix to remove certain header fields from outgoing mail, such as the first received line that contains the User-Agent string and the IP address of the sending client as described in this answer on Ask Ubuntu.
I have also set up OpenDKIM and OpenDMARC to verify incoming mail and configured OpenDMARC to reject mails that fail DMARC evaluation. Unfortunately, mails that fail DMARC evaluation are not rejected by Postfix when the subcleanup service is enabled and configured as in Ask Ubuntu answer mentioned above. When I disable the subcleanup service and essentially revert the changes from the Ask Ubuntu answer, then postfix is correctly rejecting mails that fail DMARC evaluation again.
When subcleanup is disabled and mails get rejected, the postfix log says something like this:
Feb 28 15:21:38 mx0.domain.tld postfix/cleanup: AA11111A1A: milter-reject: END-OF-MESSAGE from foobar.com[2000:aa:aaaa:aaaa:aaaa:aaaa:aaaa:aaaa]: 5.7.1 rejected by DMARC policy for someotherdomain.com; from=<firstname.lastname@example.org> to=<email@example.com> proto=ESMTP
So the cleanup service is involved in rejecting incoming mails that were rejected by milters. I believe that the subcleanup service somehow overwrites the cleanup service and therefore does not reject incoming mail that failed DMARC evaluation.
Question: How can I configure the subcleanup service (with the goal to remove sensitive information such as IP addresses and UA strings from outgoung outgoing mail) and make postfix correctly use the cleanup service to reject incoming mail that failed DMARC evaluation.